Despite the promise of data privacy in FL, recent work showed that the heuristic of sending gradient updates instead of training samples themselves in fact provides a false sense of security. [1]} showed in their seminal paper that it is possible for the server to recover the full batch of training samples given aggregated gradients. These optimization-based gradient inversion attacks operate by optimizing a set of dummy data \(\tilde{\mathbf {x}}_1,\ldots ,\tilde{\mathbf {x}}_B\)  and labels \(\tilde{y}_1,\ldots ,\tilde{y}_B\)  to match their gradient to the observed gradient:
\(\min _{\tilde{\mathbf {x}}} \left\Vert  \sum _{i=1}^B \nabla _\mathbf {w}\ell (f_{\mathbf {w}}(\tilde{\mathbf {x}}_i), \tilde{y}_i) - \sum _{i=1}^B \nabla _\mathbf {w}\ell (f_{\mathbf {w}}(\mathbf {x}_i), y_i) \right\Vert _2^2.\) 
